1

I am trying to find out a password for an area of a website that uses the GET method to authenticate correct credentials. The page is an .aspx but I'm not sure if that makes any effective difference.

The facts:

  • I already know the username.
  • There is no protection against bots - Ex: there is no CAPTCHA protection. There is nothing in place to validate that a human is making the login attempt.
  • Retries are unlimited. The page won't kick you off or force a cool down period for subsequent failed attempts.

This is not a homework question or project, and more importantly, obtaining and using the password (if found) does not violate any laws.

I am just not familiar with using brute force programs to crack the password. All I know about brute force password crackers is that they systematically attempt to login using either a provided dictionary txt file of passwords or an auto-generated list.

I've tried Brutus and one other program on a Mac that I forget the name of. Both of them have not given me anything useful and seemed to have not made a single attempt either. I don't know if brute force is the way to go or if I'm using out-dated programs, but whatever the case, does anyone know how I could crack the password?

As I mentioned before, there is no legal concerns here. I am merely trying to prove a point to someone who thinks that developing his own login script is better than implementing a package that has already covered these "hacking" prevention issues.

If anyone believes that this question is inappropriate or unacceptable for superuser.com, please migrate it to another stack exchange family member. If it is totally out of line, I'm sorry, vote to close or delete it.

Thanks for any info

2 Answers 2

1

Well, given a 6-character long password with a-z, A-Z, 0-9 and special characters (for argument's sake, we'll use those found above the numbers on a qwerty keyboard) you're looking at 139,314,069,504 possible combinations. That's over 4,000 years to crack @ 1/sec. Even a 5-character letters and numbers only password is 916,132,832 combinations and ~29 years to crack @ 1/sec.

I suppose you could get a group of computers all trying at the same time, but how many machines are you going to use to divide workload?

What is more probable is finding another way in; this is usually a SQL injection or a miss-check that allows you either direct or round-about access to the database so you can dump the (presumable) password hash or direct password. Then, it's a lot easier to have a look-up table or algorithm that breaks down the hash.


Answer aside, with regards to your comment:

I am merely trying to prove a point to someone who thinks that developing his own login script is better than implementing a package that has already covered these "hacking" prevention issues.

There's something to be said for writing your own; experience, triumph & trust (among others). Don't get me wrong, as a software guy I've learned to appreciate libraries others have written, but if I never wrote my own String class I don't think I would have as much appreciation for the data type (nor as much understanding about memory management). With that said, if this is a production environment I do agree with you and a "professional" library should probably be used.

0

How about writing a little script that generates every possible permutation of password (or uses a dictionary) and spawns an instance of WGET (with limits of course to avoid killing the system with millions of processes)?

By having numerous instances of WGET running in parallel, the time it takes to find it will drastically reduce (Brad mentioned 1/sec, but this way, you have 10, 100, or 1,000/sec, limited only by your Internet connection).

The key of course will be in the format of providing the username/password to the page. You said POST/GET in the title, but I wonder if that is correct (most sites use only one; using both would be pointless).

5
  • Writing a little script is useless (in my opinion) because brute force programs exist that do the same thing. POST/GET didn't imply both were employed. The site uses GET specifically, but I didn't think that mattered Feb 1, 2012 at 2:52
  • > The site uses GET specifically, but I didn't think that mattered Sure it does, the two methods send the username/password in very different ways. > Writing a little script is useless (in my opinion) because brute force programs exist that do the same thing. Then what exactly are you looking for? timing attacks? resource attacks? vulnerabilities? social-engineering? Your question is vague.
    – Synetech
    Feb 1, 2012 at 3:04
  • I reworded the question so that it only addresses the GET method. Also, I was just saying that writing my own brute force script is redundant considering that those programs exist already Feb 1, 2012 at 3:11
  • > I was just saying that writing my own brute force script is redundant considering that those programs exist already Yes, which begs the question exactly what then you are looking for.
    – Synetech
    Feb 1, 2012 at 3:21
  • I'm looking for clarity. I mentioned that I'm not familiar with using brute force programs and also that I don't know if brute force is the way to go, and if not, what is? In short, what is the best and/or most effective way of obtaining a password given that the authentication is a GET method of an aspx page Feb 1, 2012 at 3:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .